Google pushes fixes for critical code-execution bug in Android

Fix for bug in Android's Stagefright code library coming to a handset near you.

LAS VEGAS—Google and its Android partners on Wednesday started distributing a fix for a vulnerability that could cause millions of phones to execute malicious code when they're sent a malformed text message or the user is lured to a malicious website.

Further Reading

The flaw in an Android code library known as Stagefright was disclosed last week, several months after security researchers privately reported it to engineers responsible for Google's Android operating system. Google engineers, in turn, have introduced changes to the Android text messaging app Messenger. The changes mitigate the threat by requiring users to click on videos before playing them.

Google began pushing out the updated app and other unspecified safeguards to Nexus devices and will be releasing them in open source later in the day, once full vulnerability details are disclosed. Google already sent the fix to hardware partners, and according to the Android Police news site, both Sprint and Samsung have started pushing out the updates. Updated handsets include the Nexus 5 and Nexus 6, the Galaxy S5, S6, S6 Edge, and Note Edge, the HTC One M7, One M8, One M9; LG Electronics G2, G3, G4; Sony Xperia Z2, Xperia Z3, Xperia Z4, Xperia Z3 Compact; and the Android One.

Google also announced changes to the way the company distributes Nexus security updates. Starting Wednesday, Nexus devices will receive regular monthly security updates. The updates will roll out for the Nexus 4, Nexus 5, Nexus 6, Nexus 7, Nexus 9, Nexus 10, and Nexus Player and include fixes for the libStageFright issues. Samsung reportedly introduced a revamped update process for many of the Android phones it sells.

At the Black Hat security conference in Las Vegas on Wednesday, Adrian Ludwig, Google's lead engineer for Android Security, said the researcher who discovered the Stagefright bug exaggerated the threat it posed to real-world users. More than 90 percent of Android phones have a security measure known as address space layout randomization, which is designed to significantly lessen the damage attackers can do when exploiting vulnerabilities. He also said less than 0.15 percent of Android devices that install apps exclusively from the Google Play market have any kind of potentially harmful app installed.

The seriousness of the vulnerability and the number of vulnerable phones have renewed calls for Google to improve the way it distributes security updates. For years, many popular phones rarely if ever got updates. It's too early to know if the update changes announced Wednesday will solve this problem, but the number of manufacturers and models pushing Wednesday's Stagefright fixes are a hopeful sign.